Executive Summary
Enterprise AI governance has crossed a line. For years, governance in the data, analytics, and AI stack has centered largely on the data layer: access, lineage, classification, quality, ownership, and trust. Enterprises have also governed applications, APIs, workflows, and production systems. Those controls were designed for deterministic software, however—not for probabilistic agents that can reason, retrieve context, invoke tools, and dynamically choose execution paths.
Agents complicate the operating problem, by retrieving context, invoking tools, calling APIs, and creating documents and files, requiring real-time oversight. This challenge is expected to only grow: Deloitte reports that 74% of organizations expect to use AI agents at least moderately by 2027, whereas only 21% say they have a mature governance model for them.[i]
Governance can no longer stop at predefined control points such as catalogs, application roles, API gateways, and workflow approvals. Extending into runtime control empowers enterprise leaders to enforce identity, authority, policy, cost, and accountability in real time, fostering confidence in managing autonomous agents.
Increasingly, technology providers and enterprise architects are converging on a similar conclusion: Governance must evolve beyond the data layer into the runtime where AI systems execute. Recent work from Thoughtworks and Databricks provides a useful example of runtime governance architecture.[ii]
[i] Kulkarni, Hohener, Ritter, et al., “The State of AI in the Enterprise: The Untapped Edge,” Deloitte AI Institute, January 2026. https://www.deloitte.com/cy/en/about/press-room/state-of-ai-in-the-enterprise.html
[ii] “Where AI governance is headed: Best practices for unifying data, models and agents,” Databricks Data+AI Summit, June 17, 2026. https://www.youtube.com/watch?v=UrhnwOPJG4w
